Constitutional Court Finds Data Protection Board’s Administrative Fine Contrary To The Principle Of Legality

The Constitutional Court, in its decision dated 27.01.2026 and numbered 2020/32193, published in the Official Gazette dated 16.06.2026, determined that the administrative fine imposed by the Personal Data Protection Board (the “Board”) on a data controller on grounds that the concept of the ‘purpose for which the data was made public’ is not regulated under the law and administrative fine imposed based on the relevant concept violates the principle of legality of offences and penalties (which also applies to misdemeanours).

Processing of Publicly Available Personal Data and Administrative Fine

The case before the Constitutional Court arouse from a complaint filed before the Personal Data Protection Authority by an individual who had been contacted by phone without his/her explicit consent by the data controller for the purposes of providing information on the data controller’s insurance activities and arranging an appointment relating to the same. 

The relevant data controller stated in its defence that the relevant data subject’s name, surname and telephone number had been obtained from a website and were publicly available on the relevant website. Accordingly, the data controller argued that pursuant to Article 5/2(d) of the Personal Data Protection Law No. 6698 (the “DPL”), personal data made public by the data subject may be processed without obtaining explicit consent.

Whereas the Board confirmed and acknowledged that the data subject’s information may have been available on the relevant website for a certain period, upon examination of the parties’ arguments, the Board determined that the data controller used such data to request an appointment regarding its own commercial activities and therefore, the data was not used to ‘benefit from the data subject’s professional competence’ which is the purpose why the relevant data subject made public his/her relevant personal data on the relevant website. The Board stated that the data had been used contrary to the purpose for which the relevant personal had been made public by the data subject. Therefore, the processing could not be assessed under Article 5 of the DPL setting out the legal grounds on which personal data may be processed for non-sensitive personal data. Accordingly, the Board determined that the data controller breached Article 12/1(a) of the DPL because the data controller had failed to take the necessary measures to prevent the unlawful processing of personal data, and imposed an administrative fine of TRY 100,000 on the data controller.

The Data Controller’s Objection against the Administrative Fine

The data controller objected to the administrative fine before the Criminal Judgeship of Peace with argument that the data subject’s relevannt information had been obtained from a publicly available website and this is compliant with Article 5 of the DPL. Therefore, the data controller argued that its processing activities was not unlawful. Although the Judge partially upheld the objection as to the amount of the fine by finding that the decision had failed to justify departing from the statutory minimum and accordingly reduced the fine to TRY 17,828, the Judge agreed with the Board’s assessment regarding ‘use contrary to purpose for which the data was made public’ and held that the administrative sanction decision was lawful both procedurally and on its merits.

The Constitutional Court’s Decision and Assessment

The data controller brought the matter before the Constitutional Court, arguing that the imposition of an administrative fine based on the concept of the ‘purpose for which the data was made public’ which is not defined in the law was contrary to the principles of foreseeability and legal certainty and therefore violated the principle of legality of offences and penalties.

In brief, the Constitutional Court made the following determination:

• the principle of legality of offences and penalties is specifically protected under Article 38 of the Constitution and, although it does not apply to misdemeanours as strictly as it applies to criminal offenses, it also generally applies to misdemeanours;
• in accordance with the relevant principle, persons must be able to understand from the law in force at the time of an act whether that act may result in a penalty or not;
• Article 5 of the DPL provides that explicit consent is not required where personal data has been made public by the data subject, but does not clearly regulate how such data is deemed to have been made public, the purpose for which it was made public, or whether its use for a different purpose is subject to a sanction;
• the concept of the ‘purpose for which the data was made public’ is explained only in a practice guide published by the Personal Data Protection Authority, and imposing a penalty based on a concept not expressly provided for by law therefore amounts to an unforeseeably broad interpretation of the relevant provision; and
• the administrative fine decision did not address why the data controller was considered a data controller in respect of data made public by the relevant data subject, or the responsibility of the website on which the data was originally published.

In light of these findings, the Constitutional Court held that the principle of legality of offences and penalties under Article 38/1 of the Constitution had been violated and, accordingly, found it unnecessary to separately examine the data controller’s remaining complaints concerning the right to a fair trial and the right to property.

While data controllers may rely on the ‘making public’ legal basis only where the processing purpose is consistent with the data subject’s intention in making the data public in accordance with the personal data protection legislation, this decision of the Constitutional Court also means that an administrative fine cannot be imposed merely because publicly available data is processed for a purpose that is inconsistent with that intention. The decision confirms that obligations or restrictions not expressly provided for by law cannot be introduced through secondary legislation, Board decisions or guidelines, nor can administrative fines be imposed on that basis. As the Constitutional Court also emphasized, the obligations and concepts forming the basis of administrative sanctions must be clearly and precisely set out in law and be sufficiently foreseeable; otherwise, sanctions based on rules or interpretations that fail to meet these requirements would be contrary to the principle of legality of offences and penalties.

The requirement to use personal data for ‘purpose for which the data was made public’ is currently expressly regulated under the DPL only for sensitive personal data. In fact, Article 6 of the DPL states that if an individual makes their sensitive personal data public, the data may only be used ‘consistent with the data subject’s intention in making the data public’. However, Article 5 relating to non-sensitive personal data only requires that the data have been made public by the data subject and does not impose any additional requirement that the processing be consistent with the data subject’s intention in making the data public.

Although the general principles under Article 4 of the DPL should be taken into account for all personal data processing activities by data controllers in principle, unless Article 5 is amended in parallel with Article 6 in respect of non-sensitive personal data, the Constitutional Court's decision presents a substantial legality obstacle to imposing administrative fines solely on the ground that such data has been processed for purposes other than the purpose for which it was made public. This creates a significant enforcement gap and a risk for individuals in cases where their personal data obtained from websites, social media, public registers or other publicly available sources is processed for different purposes.

Certainly, under the general principles of the DPL, data controllers must ensure that personal data processing activities are relevant, limited and proportionate to the purposes for which the data is processed. However, in light of the the Constitutional Court’s decision, the obligations forming the basis of administrative sanctions still need to be clearly and foreseeably set out in law. The decision once again underlines the need to revize the DPL’s provisions about the conditions for processing personal data and the administrative fines for misdemeanours.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.